v8/test/mjsunit/compiler/regress-958716.js
Georg Neis 87b3416a87 [turbofan] Fix a bug in DepenOnStablePrototypeChains
When asked to start at the receiver and the receiver is a primitive, the
dependency should be taken on the primitive map (which is a no-op)
rather than the wrapper object's map.

Bug: chromium:958716
Change-Id: I9c8b2b56436d134b2f79dbe458c0c527fe6d17a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593086
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61174}
2019-05-02 14:25:03 +00:00

18 lines
361 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
for (let i = 0; i < 2; i++) {
(new String()).valueOf = Symbol;
}
function foo() {
Promise.resolve("");
}
foo();
%OptimizeFunctionOnNextCall(foo);
foo();